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Token-based p ersonalization of smart appliance ^ 



FIELD OF THE INVENTION 

The invention relates to appliances whose user interfaces can be made less 

invention relates to the use ofaphysical token or tag to indicates the identity of the user 
5 and mechanisms by which profile data may be obtained from a store accessible via a 
network. 

BACKGROUND OF THE INVENTION 

Many modem appliances such as televisions, telephones, computers, etc. are 

10 capable of p^vid^ 

them to be personalized to make them easier to use. An example is set top boxes that provide 
personalized electronic program guides (EPGs). These can be personalized either acuvely. 
by specifying rules for selecting or filtering out programming; or passively, by allowmg the 
set top box to extract rules from use over an extended period of time. Another very simple 

15 exampleofapersonalizedappliauceisatelephonespeeddialdfrectory. Stillanother 

example of a personalia* appliance is a desktop computer, whose applications usually allow 
a large variety of personal settings to be established to customize the working environment. 

A first drawback with many such appliances is the lack of an ability to store 
multiple profiles in an appliance. In addition, if a new appliance is purchased, rented, or used 

20 (suchasduringavisitto another's residence) the personal data generated by one appliance is 

not available for use with another appliance. 

A second drawback with the above personalization approach is the fact that 
each of multiple users of a single appliance may employ divergent criteria for selecting 
features. These may conflict as when personalizing a user interface of a computer. 
25 Alternatively they may expand the option space so much that the benefits of personalizati on 
are diminished as when each member of a family make personalization contributions to a 
television EPG or a speed dial list In the example of an EPG, one family member' s selection 
of documentaries, another's selection of sitcoms, and another's selection of sports contributes 
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tothe expansionofthe selectionsp.ee to so^tbatisneaxly asixnpexs.r^asa, 

unpetsonalizedEPG. difficulties in the particular 

One attempt to overcome the first of tbe ioregoing tu^ 

anvtamen. of . U-t **> - ° f — "* " ^ * Pe T\ , 8 , _ 
add^Uinserfedinaseftopbo*. Infonnationoa^smartoardis^^toan 

,0 »^«d»— T^fc-*— ■ TWornutiondeUveaedbymeserver 
M „d M filtering ^formation for viewing web si.es, access privilege data in the ft. of a 
ticket, and favorites lists. The ticke. is need to invoke permissions at web sites end provtde 
for at leas, one cusmmized response. The specification describes sending the user's ema.1, 
favorite links, titles inaUEL, and thumbnails in response to tire ticket. 
15 Ano.herpaten.DE 197 13 271 briefly describes a client-setver system m 

which a transponder is nsad to classify a nser and me services daUvered to the client 
. ensfomized baaed on information specific feme user or user-class. This can address the 
second of the drawbacks be causing the appliance .0 swMr to a different personataation 
depending on the user. 

2 0 1 " Another patent GB 2 325 537 addresses the second of the drawbacks m the 
area ofEPG applications. In this application, each user in a group, such as a family, 
identifies himseltTherself as a current user. Separate profiles are developed by each user. 
Then, when multiple users watch the television together, their profiles are, selectively, after 
logically ANDed or logically ORed to produce a new profile that is then used to filter the 

25 • EPG. 

The prior art techniques solve some of the difficulties of adapting appliances, 
' but there is a need to make it easier for a user to personalize an appliance and to transfer 
information about preferences from one appliance to another. In addition, there is a need to 
make it easier and more convenient to combine the profiles of multiple users. Furthermore, 
30 the mechanisms for providing such convenience must be such that manufacturers can provide 
them without having to support complex .enriee infrastructures such as required by me smart 
card system described in US Patent No. 5,983,273. 
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SUMMARY OF THE INVENTION 

Briefly, a radio frequency identification (MID) token is used wuh appliances 
to access profile data to personalize the appliance. Each token contains a pointer to a relay 
location on a network with a further pointer indicating a profile location where user-profile 
5 dalaisstored. When a user wants to use an appliance, he/she places the token near the 

appliance and the appliance accesses the data from the site indicated (pointed to) by the relay 
location. The profile location may contain many different types of data such as speed dial 
lists, media preferences, preferred product classifications, etc. The appliance could obtain 
just the information it required, for example if the database were XML-tagged, by filtering 
10 outinelevantcontentandpersonaJizeitselfaccordingly. When multiple users wish to use a 
single appliance, for example a television, each may place his/her token near the appliance 
and the appliance may then combine relevant profile data accordingly to develop a single 
composite profile to use to personalize the appliance. 

A component of the invention is an MID tag or token or any suitable device 
15 capable of storing identification, authorization, and/or authentication data. Each MID device 
contains a unique Internet uniform resource locator {URL} called the relay location. The 
relay location URL stores a profile URL that is owned and maintained by and/or for the user. 
A manufacturer of the device could supply them with new set top boxes/telephones, 
televisions, computers, or other appliances. The user may maintain his/her personal data at a 
20 location - a profile server - that is independent of the relay location, which corresponds to the 
token only. 

The token or device may simply be placed near the smart appliance while the 
user is using it. The device may be required to be placed close to me appliance or it could be 
permitted to work in a field that is a substantial radius, say several meters, as in a Bluetooth® 

25 network. If the device is used in a physical setup where a user may leave the vicinity of the 
appliance for a period of time and then return and it would be disruptive to have the profils 
removed during that interval, the appliance could provide a persistence period option. Thus, 
the user could indicate the length of the maximum interval after which the non-presence of 
the device should indicate that he/she is no longer a current user. This could be.useful in 

30 situations where many people are simultaneously using an appliance. For example, when one 
member of the family gets up to make some popcorn, it would be undesirable for that user's 
profile data to be removed from the pool. To prevent transient occupants from being added 
to the user group, the detection of a token would not cause the addition of a user to a group 
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unless confirmed or authenticated. Thus, the appliance could request confirmation that a new 
occupant confirm that he/she should be added to the user group. 

Alternatively, the devices could be required to be placed right near the 
appliance. In this scenario, each user would leave his token or device on top of or near the 
5 appliance while he/she is expected to remain an active member of a group of users. This 
would have the advantage of preventing inadvertent addition of transient occupants of the 

room being added to the user group. 

When the token establishes a link with a smart appliance, it conveys the relay 
URL and an identifier of the token. The smart appliance accesses the relay URL, which 
10 responds by transmitting the profile URL. The smart appliance then attempts to link with the 
profile URL. For security, the token may provide data identifying the token as well as the 
relay location URL and the smart appliance may be required to transmit this identifier to be 
authorized to link with the profile location. With this authorization requirement, if a user lost 
his/her RFID device, he/she could indicate the loss of the device to the profile destination. 
15 Subsequent attempts to use the device could then be unauthorized. Thus, another user 

attempting to access the first user's data would fail the authorization and be unable to access 
the profile data. Alternatively, authorization could be handled through the relay location 
server. In this case, the lost device or token could be reported to the supervisor of the relay 
' server, which could then no longer transmit the profile URL in response to service requests 
20 from the lost device. Alternatively, the relay URL could simply be discontinued for all time 
or reused by coupling it to a new secondary authentication tag. The latter may be 
implemented by having the relay server require an authentication code from the device before 
returning the profile URL. Still another alternative is to provide security at both the relay 
server and the profile server. 
25 Returning to the use scenario, assuming a link has been established betweeia 

the smart appliance and the profile server, the user(s) may be prompted to enter a PIN 
number or some other authentication device to allow the profile to be used. The user may 
enter the authentication information on the appliance or via the RFID device itself. Thus, the 
tag could be provided with a small user interface allowing input and display of data. 
3 o The appliance could continuously poll its vicinity to determine the constitution 

of the current group of users. If the group has changed, the appliance may take appropriate 
action. The token may be a radio terminal, a transponder, an RFID tag, or any other kind of 
device that is able to transmit data wireleissly. If the device has its own power source, the 
appliance would not have to poll for new devices. 
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As the constitution of a user group changes, the appliance may provide 
irfonntfionabouttlKc^ 
conflicts. P^eswiUmevitablycoat^ 

r^U limited to simple logical operations -^^-^"/^^'^ 
createamoreintelUgentreconciliation. A user interface to support such an interactive 
10 allowmeus e r(s)toselect fr omamon g *em For example,* the above case where a user 

indifferent or might deselect them if the user snongly disfavored that category of material 

If auser leaves a group andhis/her profile is withdrawn, the apphance may he 
prog rammed to determine whether the combined-profile space has changed sufficiendy as to 
15 suggest a change to the current group. For example, suppose the only person that disfevors 
sportsleavesthegroupleavingonly^oversbehind. The current compronuse of 
sitcoms resulting from an intersection of the profiles of the earlier group could be drasucally 
altered generating much stronger matches with the now-current group preferences. So m this 
case, the appliance (e.g. , television) would suggest new programming for the group to 

20 consider. . 

Combining profiles need not be a constant homogenized solution space. It is 

possible for a single group, which is planning to watch TV for a period of, say two hour, to 
compronuse in a time-dependent way that maximizes the value for all members. Suppose the 
combination of profiles suggests highly preferred programming for one member or subgroup 
25 during the first hour and highly valued programming for another member or subgroup d^g 
the second hour. If the appliance knew the time during which the group would use the 
appliance together, it could make use of that information to allow selections to be made that 
would segregate the high value selections in time. The result would be that one member 
would get to see his/her most preferred programming during a first interval while another 
30 would get to see his/her most preferred programming during a second interval. 

When a consumer buys an appliance, multiple RFID devices may be shipped 
with it. Alternatively, a single device may be shipped with a new appliance and further 
devices purchased when and if required. If the devices are to he used with multiple types of 
appliances or even multiple appliances made by multiple manufacturers, there may be a 
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communications protocol standard that aU would adopt. Alternatively, different protocols 
may be osedby different manufacturers and each appliance builtto recognize and interact 
with the devices of other manufacturers. If multiple devices are shipped with a product, to 
prevent wasted resources in the relay server, auser is required to register his/her dev.ce. The 

5 user logs onto the relay server, autoorizes him/herself as a validuser, and enters the profile 
URL The user can always change ox update this URL, but the resources required for each 
user is very small so that many users can be serviced with a very small storage space. AUo, 
to niinimize contact with toelrelay server, appliances can be programmed to persist the 
profile data or the URL data for a period of time before the data is expired. Preferably this 

10 data is never revealed unless via a secure interface, so storage on the appliance should no: 

present a privacy problem. • 

The invention contemplates a private profile database. According to one 
feature of the invention, each appliance may contribute information to this database. The- 
prior art contains various descriptions of systems that adapt to user preferences by observing 
15 user-interaction with the appliance. For example, by observing a user's programming 

choices over time, an EPG set top box can derive rules and use these to personalize the EPG 
in the future. This profile data may be uploaded by toe appliance to toe user's personal 
profile server. Preferably, the data format would be standardized across multiple classes of 
appliances, but mis is not essential. For example, the data could be XML-tagged and stored 
20 ad hoc, allowing various devices to make sense of it through toe tagging- 

As described above, the invention provides, among other things, toe ability to 
"move" profile or preference data among various appliances. It also provides the ability to 
associate the profile or preference data with a physical object rather than something that must 
be memorized, like a URL. : It further provides a simple, fast, convenient mechanism for 
25 identifying a user without requiring data entry through a user interface. It still further 

provides toe ability for an ad hoc group to be defined and indicated to an appliance and have 
multiple user profiles merg'ed thereby. Still further, it provides the ability for a manufacturer 
to provide a key to the supporting service infrastructure without requiring the manufacturer to 
support toe bulk of toe necessary data. The latter feature has the advantage of permitting 
30 devices for making toe user's data more secure and private. 

The invention will be described in connection with certain preferred 
embodiments, with reference to the following illustrative figures so that it may be more fully 
understood. With referenc^ to the figures, it is stressed that toe particulars shown are by way 

of example and for purposes of illustrative discussion of toe preferred embodiments of toe 

i 
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p^ent invention <*, and ale present in the eause of providing »na, is betteved * be te 
O os< useful and readily understood description of the principles and conceptual aspects of me 
iuvenuon. In mis regard, no Wempt is made to shov, shuctural derails of Are invention rn 
more detail than is ueeessaryifor afuudamental understanding of the invent™, the 
5 deacriptiontalren »*h me dftngs making apparent u, those *iUe4 indae art ho W to 
several forms of the invenfioi may he embodied In practice. 

j 

BRIEF DESCRIPTION OF THE DRAWINGS 

Fig. 1 is a schematic Mustauion of asysteminwhichmtheinventioamaybe 

10 advantageously applied. j 

Fig. 2A is an illustration of a television with a set top box generating an 

elecnonic program guide inUich the invention may be used. 

Fig. 2B is an'illustration of an RFID token according to an embodiment of the 



invention. 

15 Fig< 3 is an illustration of a set of connections used by an appliance to obtain 

profile data according to an embodiment of the invention. 

Fig. 4 is a flow chart indicating a procedure for obtaining profile data 
according to an embodiment of the invention. 

Fig. 5 is a flow chart indicating a procedure for adding a new user to a group 
20 of users according to an embodiment of die invention. 

Fig. 6 is a flow chart indicating a procedure for removing a user from a group 
of users according to an embodiment of the invention. 

Fig. 7 is a flow chart indicating another procedure for adding a new user to a 

group of users according to! an embodiment of the invention. 
25 " F ig. g is a flow chart indicating another procedure for removing a user from a 

group of users according to an embodiment of die invention. 

Fig. 9 is a flbw chart indicating one type of secure procedure for accessing a 
user profile according to an embodiment of the invention. 

Fig. 10 is a how chart indicating another type of secure procedure for 
30 accessing a user profile according to an embodiment of the invention. 

Fig. 1 1 is a kow chart indicating a procedure for providing new options to a 
group of users whose profile mix has changed. 

Fig. 12 is a flow chart illustrating a user interface for allowing a group to 

optimize a mix of profile data 
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DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 

Referring to Fig. 1, the invention will be described in the environment of an 

electrogram 

5 compute, (or ''set-top box^^^^ 

The computer 240 may be equipped to receive a video signal 260 and control a . channel- 
changing function as well as fccept search queries through user input devices such as a 
k evboard211orhandheldreLecontrol210. The EPG can be browsed based on sample 
criteria such as a default filter (such as current time of day) as well as queried using a search 

10 engine process. The computer 240 may also be programmed to allow a user to select 
channels through a tuner (no shown) inside the computer 240 rather than through a 

television's tuner (not sho wn> ™* ca * SeleCt * Vl0 ^ * * ^ * , 
highlighting a desired selection from a displayed program schedule using a remote control 
210 to control the computer The computer 240 has a data link 260 through which it can 
15 receive updated pro^scnedule^ ' 
Internet service provider or iome other suitable data connection. The computer 240 has a 
mass storage device 235, foj example a hard disk, to store program schedule informal 
program applications and up| grades, and other information. Information about the user's 
preferences and other data Jan be uploaded into the computer 240 via removable media such 
20 as a memory card or disk 220. Alternatively, information may be obtained from a 
transponder such as an RFID token or device 100. 

EPG data miy include titles and various descriptive information such as a 

j keywords categorizing the content, etc. These may be searchable 
le user interface (Ul). Referring now also to Fig. 2, the program 
25 IZ^^rZZ shown to the user and browsed by the nser. The attendant display may be 
in the form of a time-grid 170 similar to the format commonly used for existing cable 
television channel guides. In the time-grid display 1 70, various programs are shown such as 
indicated by the bar at 13ol The length of each bar indicates a respective program's duration 
and the start and end point! of each bar indicate the start and end times, respectively, of each 
30 respective program, A description window may be provided to show detailed information 

about a currently selected program. 

Content may be supplied from Internet servers 276 a satellite receiver 103 via 
any type of network 274 including radio, cable, optical, twisted pair or other metallic wiring. 
The content can be delivered as digital or analog signals. 



narrative summary, various 
as full text through a suitab 
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Note that many substitutions ate possible in the above example hardware 
enVK onmentandaUcanbeu^ 

.eplacedbyvolatile memory ir non-volame memory. The data can be stored locally or 
5 throughaliuk. 

whichcomdbeseparateU^^ h . 

or obl.medfromamasssto^eorremovable storage medium, It could be carried by a 

orothernetworksuitablefo "ynchmnousdatacomnrumcation. Contemc^uldbe 
synchronous and tolerant oidropouts so that present-day P networks could he used 
Further, me content of the life through which programming content is received could be 

15 selectionsarepossible. The program guide data can be received through channels other than 

theseparatedatalink260. ^W-l*^^^* 1 * 
thesamephysicalchannelaithevideoorothercontent. It could even be provided through . 

removable data storage media such as memory card or disk 220. Tbe remote control 210 can 
be replaced by a keyboard, Lice command interface, 3D-mouse, joystick, or any other 
20 suitableinputdevice. aJ^^^m^^^^^^^^ 
a selection symbolically (e.g., by aname or number), or making selections in batchform 
through a data transmission or via removable media. 

Referring now to Figs. 2A, 2B, 3, and 4, the RFTD token 1 00 has a non- 
volatile internal memory 5 j>2 for storing data and a transmitter 501. The token 100 has tan 

25 placedneartheappli^^ 

indicated as a general appl ance 340 in Fig. 3. This permits the appliance 340 and the RFID 
to establish a communications link momentarily such as to allow the RFID token 100 to 
transmit its relay URL i nfJrmation, and optionally, authentication data to the appliance 340. 
This occurs in step S10 of Fig. 4. Then, in step S15 the appliance 340 accesses the relay 

30 URL in a message that coitains.. optionally, information identifying the particular token 
and/or authentication infoLation to authorize the relay server 3 10 to provide the profile ; 
URL data. In step S20, the relay server 310 may authenticate the request and then look up 
and transmit; backto the appliance 340, the location of the profile data. In step S25, tins , 
appliance 340 generates aUquest to the profile server 305 which may optionally contain 
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10 



15 



20 



25 



. . j ^ c ;«'eten^O thenrofile data is returned. Note that 
authenticatioD/authorization data. Finally, in step 30, tne prome 

profile data may be obtained ikamultistep process whereby the appliance interrogates *e 

profiledatabase to determine the data that is available or alternatively, the appliance 340 may 

the profne server 305 wmtra.smittherelevarit data. Another alternative is for the profile, 
server 305 to package the datL in a format requested by the appliance. 

Tne servers, represented generally by the box at 630 may be standard network 
devices having a network intUee 620, a mf mory 640, and a controller 610. 

Note that instead of URLs, the location data can be provided in the form of IP 
addresses or any other suitable addressing mechanism permitting the location of data or 
processes on a network. Thi profile location may contain many different types of data such 
as speed dial lists, media pr Jferences, preferred product classifications, etc. Note that the 
appliance 340 could obtain ill the infonnatlon in the profile database or just the informatio n 
it requires. For example if the database were XML-tagged, the appliance 340 could filter out 
irrelevant content and personalize itself accordingly. Note also that features of the invenlion 
may be implemented using smart cards or other physical media, transponders, 
communications devices, etl. For example^ the relay URL could be contained in a Bluetooth 
compatible cell phone, PD/L or even a piece of flash media or a disk. Preferably, howe, ex, it 
is desirable for the device to be cheap and dapable of being transported everywhere. 

An alternative implementation of the RFID is to have the RFJD data install 
m multiple devices, one of ^hUli^ '. 
piconets become a commoiplace and people carry multiple interoperable wireless devices, 
the ID information on the RTID token could be stored in each device owned by a particular 
user. Thus it would not be Lecessary for the user to carry around a particular token. In that 
case the manufacturer of an appliance or a third party could simply provide the relay URL 
data and the relay server to 



customers or as a fee service. 
The RFID token may be shipped with a new appliance and/or sold separately. 
Examples of appliances are telephones, tefevisions, computers, kitchen appliances, PDAs,; 
movie boxes in hotel room's, VCRs, or an| device that can be customized. Appliances need 
30 not be owned by the user. For example a botel or shopping mall video ldosk could make use 
of the token for self-customization allowing it to provide relevant advice to a traveler or j 
shopper. Workers changing workstationsjjcould have the software of their workstations, set 
themselves up according to the worker's preferences no matter where the worker moved in an 
office. The customizable features may coihsist of the location of icons on a desktop, the ; 

il 1 ♦ 



'l! 
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based on television or iitovie preferences. ,„„„*il.lhe ' 

The token or device nmy simply be pUeed nesx the »t 

that interval. !: r+Uo 

One way to gel around the problem of leaving a the contact range of the 

15 ^dein^eprograrnrningoftheappUW.apersistencep 

group, theuse^profiledatas not addedto^he groups untU he/she as rernar^m the group 
L^nimumperiodoftim • After that ijpftial interval, the user's presence is ^ed 
(m ade permanent up to an interval) so that^the user leaves the room mo.entanly.nxs^ 
Lbership in the group isiotlos, Mso, * prevent transient occupants from herng added 

uriess confirmed orautt^ 

occupant confirm that he/shl should be added to the user group. 

Referrmgtok.5 3 when,ineventS40,aUserA'sRFIDlmkswithan , 

appliance in use by User's B and C, in sJsSO, the appliance starts a watehdog timer. In ; 
25 step S100, if User A actively enters the A, perhaps by clicking an icon on a television ; 
semen indicating that a new user is pending acceptance into the group, User A is added m , 
stepS65. Omerwise.mstepSSSthelm^ ; 
User A has de-linked, he/she is removed m>m the pending list and the thread of Fig. 5 is , 
terminated. If User A remains linked in Mp S55, the watchdog timer is tested in step SpC'j. If 
30 the timer has timed out,coltrol passes to! sU S65 and if not, control returns to step SI 00. 

Referring to Fig. 6, when,;ii event S70, User A's RFID de-Unks from an 



appliance in use by User's fe and C, in steS S75, the appliance starts a watchdog timer. 

televis 



In! 

step S105, if User A activly leaves the grjnm, perhaps by clicking an icon on a television 
screen indicating current members of the 1 |roup, User A is removed from the group in step 

. .5 I 



i-1 
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determine if User Abas re-linked, IfUseiA 



25 



30 



590 Otherwise, in step S80 the link is tested to 

has re-linked.be/she remains in the curren f up and the thread of Fig. 6 is terminated. If ; 
User A remains unlinked in sip S80, the Ahdog timer is tested in step S85. If the timer, 
has timed out, control passes |to step S90 and! if not, control returns to step S105. ; ; 

Alternatively, we devices co^d be ^ ' i 

appliance. In this scenario, elch user wo uldkve his token or device on top of or near the.- . 
appliance while he/she expected to remain an active member of a group of users. This would 
have the advantage of preventing inadverteA addition of transient occupants of the room j j 
being added to the user group. Referring $ tigs. 7 and 8, when a link is established, the User 
is in the group and when the link is brokeijjbe user is removed from the group as indicated 
by events S120 and SBOani steps S125 arjjdS135. j' 
For security, the token may jjrovide data identifying the token as well as the j = 
relay location URL and the smart appUancej may. be required to transmit this identifier in; : • 
order to be authorized to receive data from either the relay server 310 or the profile server j . 
305 or both. With this authorization requniment, if a user lost his/her RFID device, he/she ; 
• could indicate the loss of the device to either the profile server administrator or the relay • . 
server administrator. Subsequent attemptS-to use die device could then be unauthorized j ; 

Referring to Fig. 9, in step £210, the appliance 340 transmits the token IE) and 
authentication data (for example a PIN codfe prompted by the appliance 340). Note that ihel 



authentication data may be left out, siDcejtjie token ID may serve as the authentication. Then, 
in step S215 the appliance 340 requests the relay URL. In step S217, the relay server ■ j. 
determines whether the request is valid otinvalid and if valid, in step S220, transmits back to 
the appliance 340, the location oftheprojGle data. If invalid, the thread temunates. Instep' 
S225, the appliance requests profile data from the profile server 305. Finally, instep 230,jthe 
profile data is returned. jj j '! 

Referring to Fig. 1 0, in stepj|240, the token transmits its ID and relay URL to 
the appliance 340. The appliance then transmits authentication data and the token ID td tlie 
relay server 3 10 at step S2I5. The relay [server deteimines if the token is authorized at step 
S21 7 and if so, transmits the profile URL'it step S220. If the token is not authorized, a 
rejection is transmitted and| the thread is terminated. Then in steps S225 and S230, the 
data is transmitted to and received by, respectively, the appliance 340. 
An example! of a relay URL is: 
http://123.123 .123.123/tdcens/<token ID> 
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Preferably this would link to Jjso-called dynamic web site that took in the 



10 



15 



25 



argunxent^tbintherestoftbtuRL.Mex^pleofaprofileURLis: . . 

containsasecret directory na|ne which acts as a password so that it cannot be accessed^ 
ThedamxHec^uldsimplybedownloadedbianyapphanc.acce.singit Alternately, the; . 
profile URL could point to a kyuamic site it prompts an exchange. For example, such i 
sitecouldieqnestdataid^tiWltetypeiappUance. A profile server process could use , 
this informationto transmit July the releva|t data for the type of appliance. In addmon, thte , 
use*) may be prompted to enter a PIN nuiber or some other authentication device to alow 
the profile to be used. The u er may enter A authentication information on the appliance ox 
viatheRFIDdeviceitself. Thus, the tag could be provided with a small user interface j 

. i 





allowing input and display of data. | 



When a token is lost, the relly URL could simply be discontinued for all time 



or reused by coupling it to a 



new secondary authentication tag. 



As the constitution of a user {group changes, the appliance may provide 
information about the combined profile so that me group can make adjustments or reconcile 
conflicts. The goodness of fit of avaUablelptions to the groups preferences in combination 

20 canusuaUybedeternnned,Uen^ ^f?" 
isoutsidemescopeoftHspatent.soitwilinotbediscussedhere. However,each j | 

combination of profiles would permit a unique set of options, each of whose combined value 
can be determined. Thus, a group of sportS-lovers would achieve a higher total value injth^r 
most preferred set of choices than a group! tontaining a mix of tastes. Referring to Fig. p , j 
when a group changes composition in stepjS400, the appliance 340 may recalculate the [ 



Profiles will 



30 



combined profile in step S<lo5. In step s4o, the value of the profile may be determined in 
step S410 and if greater than the value of jhe previous profile, in step S415, the appliance, can 
present for selection the ne » set of options in step S420. 



inevitably contain imperfect information and methods for 



reconciling them may always be limited to some extent Thus, for example, the non-presence 
of sitcoms in one user's profile could indicate indifference or antipathy. The mechanism for 
reconciling may be limited to simple logilal operations such as union or intersection of sets 
of rules. Presenting feedback on the combined profile could allow the users to create a more 
intelligent reconciliation, deferring to Fig. 12, a user interface to support such an interactive 
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.eocciMon m, display aH *e clones M»d tnatenal *» ft. « - ^ 

I*— Fo, example, inHg. U..-»**» 
displays agones 510 from U nsefsproffle in a firstaxea of a screen 500. In a secono 
«a 505 <ae toerface displays selected categories 525 generated!., cabining gtoap . 

as indicated by tbe arrow 515. . 

CombUDgprifitoiiiMd^ »«r . 

possible for a single group, jbich is planning to watch TV for a period of, say two hours, to . 
compromise in a time-depenient way that Maximizes the value fox all members. Suppose the 
combination of profiles suggests highly preferred programming for one member or subgroup 
during the first hour aud highly valued programming for another member or subgroup during 
the second hour. If the apphance knew the time during which the group would use the 
appliance together, it could Ue use of that information to allow selections to be made taut 
womdsegregatemehighvlueselectionsintime. The result would be that one member , 
would get to see his/her mo t preferred programming during a first interval while another ; , 
would get to see his/her molt preferred programxmng during a second interval. 

When a consumer buys an appliance, multiple RFID devices may be shipped 
with it In a preferred embodiment, each of the RFID devices is shaped differently, UTceitke ' 
pieces of a game, such as ^onopoly®. Thj* way, each member of a femily can choose the 

piece that they identify with. ' , 

Alternatively, a single device may be shipped with a new appliance and farther 
devices purchased when and if required. If, the devices are to be used with multiple types of 
appliances or even multipl I appliances made by multiple manufacturers, there may be a 
communications protocol standard that all jvould adopt. Alternatively, different protocol 
may be used by different manufacturers and each appliance built to recognize and interac: 
with the devices of other manufacturers, ij: multiple devices are shipped with a product to, 
prevent wasted resources i j the relay server, a user is required to register his/her device. The 
user logs onto the relay sei ver, authorizes him/herself as a valid user, and enters the profile 
URL. The user can always change or update this URL, but the resources required for ejich 
user is very small so that many users can tie serviced with a very small storage space. Also, 
to minimize contact with t le relay server, appliances can be programmed to persist the 
profile data or the URL data for a period of time before the data is expired. Preferably pis 
data is never revealed unless via a secure interface, so storage on the appliance should not 
present a privacy problem \ 
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The fcventioultetnplates a Avate profile database. According to one 
fea ^ of reinvention^ 

—n -^^^ZZ^S- 

over time, an EPG set top box cm denvc rules and use these to pers 

to Tn i sp ro medaU, M y)eu P lo^db,^,pU a nce,o*euse,sperso M lp^e . 

aaaver Prefer*.,, tedatnlV^uMbe^dizrfs^smdnplectaesof . 
^butulisuo.Jn^Pot^e.theda.^dbeXML-^edand^d 

adhoe > all.vrin e variousdeviL.o 1 n a i=se4eofi.fcougnthe W 

AS described ,Le, dre invention provides, rnnong ote flunp, tta abrbtyjto 

W-pronleor^de^d^^^aPP^-^^^^ 

^J^ptonleorpte^^^l^^^^^r 6 ^ 
* memorized, bkeaUFL. Wetpto^aaimple^convenientm—te | . ■ 



i,*^**^^'^*"**-""**- ***** 
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id6nniyingauscrwiuivui.i.vv 1 ,-a.-- 6 , - 

Ifcpleu^r profiles J^eby. StmW.it provides the abUity & r a n^^ 
to providealcey to the suppLng service ^cture^omreq^gthen^^to 
^portthebuikofthenece Larydata. TheW feature has the advantage of penrnthng ; ; 
devices for making the user's data more se^e and private. 

According to another feature 1 jof the invention, a user interface allowing 
interaction with the profile server or an adrnuustrative server controlling data accessible pna; 
either or both, allows the uslr to correlate particular subset of his/her profile c*ta with a ; ; 
given RHD device. For exlmple, the user|jnay buy multiple RFID tokens. Theusermay, ; 

25 through a user interface of an administrato^ process running either on the relay server, the , 
profile server or another server, associate token with only that particular subset of his/her 
profile data. The adminisnator user interne would allowthe entry of the token ID (either 
automatically or by entering a code associated with the ID effective to identify it unique ly) ; 
The user interface would pfrmit the assertion of various permissions with the partxcular 

30 token. After domg so the Lunistiationitocess would configure a gate-keeping process;** 
inured that only the specified data could jje obtained from the profile using that particular 
token. The gate-keeping process may runj 'for example on the relay server which indrcates to 
the profile server that only a specified sublet of data is authorized. Alternatively, the gate- 
keeping function may be , rovided on the profile server. Among me options provided by the 
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administrative user interface «dai«.ta^P-^«-^»^^ 

after a specified period of time! , 

Although the to mention is discussed above wilt regard to, principally, an RFp 
^.d^h^^^rf^^^^*^ Forexample 
5 theapplianceusertoterf^^ 

Note also that Jfeature of the invention is that the profile data on the profile 
server may include variegated] preference d^ that includes data relating to various , , 
appuances and contexts. Thus the profile data may include software workstation . ■ 

10 envixonmentprefe^ 

recipes, oven temperature setings, xefrigeratbr settings, dishwasher washing modes, Internet ; 
site favorites, etc. These various data may jb| stored in a single corpus of preference data.and 
accessed and administered bj the same usetWace. j 
It will be evident to those skilled in the art that the invention is not limited,™ 
15 the details ofthe foregoing illustrative ^o|Lents, and that the present tovennonrnay^ 
embodiedmotherspecfficfcr^^ : ; 

thereof. The present embodiments are fce Are to be considered in an respects as Ulustrauve 
and not restrictive, the scope ofthe invent being indicated by the appended claims rather , 
tharx by the foregoing description, and all Ranges which come within the meaning and range 
20 ofequivaler^yofthecta j 
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